Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Advisory: icedtea-web — openSUSE-SU-2019:1911 Clear all filters
TI-2019-07502 CVE-2019-10181 · GHSA-xv8g-hcfj-ppcw

Insufficient verification of data authenticity in icedtea-web

Priority LOW 38

It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be injected in a JAR file without compromising the signature verification.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.01165 Published 2019-07-31 Partial fix CWE-345
TI-2019-07503 CVE-2019-10182 · GHSA-cqfc-r7qj-5fgq

Path traversal in icedtea-web

Priority MEDIUM 41

It was found that icedtea-web though 1.7.2 and 1.8.2 did not properly sanitize paths from <jar/> elements in JNLP files.

CVSS 3.0HIGH 8.2 Network No auth User interaction EPSS 0.02743 Published 2019-07-31 Partial fix CWE-22
TI-2019-07506 CVE-2019-10185 · GHSA-3q3x-68j9-f9vv

Path traversal in icedtea-web

Priority MEDIUM 44

It was found that icedtea-web up to and including 1.7.2 and 1.8.2 was vulnerable to a zip-slip attack during auto-extraction of a JAR file.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.04022 Published 2019-07-31 Partial fix CWE-22